Align with refresh SEP and harden credential providers

auth-api/src/main/java/software/amazon/smithy/java/auth/api/identity/IdentityResolver.java

@@ -31,16 +31,17 @@ public interface IdentityResolver<IdentityT extends Identity> {
     Class<IdentityT> identityType();
 
     /**
-     * Invalidate any cached identity, forcing the next call to {@link #resolveIdentity(Context)} to fetch fresh
-     * credentials from the underlying source.
+     * Signals that a rejected identity should be invalidated if it is still current.
      *
      * <p>This is typically called by an interceptor when a service returns an expired- or invalid-credential error
-     * (e.g., {@code ExpiredTokenException}), indicating that the currently cached identity is no longer valid.
+     * (e.g., {@code ExpiredTokenException}), indicating that the identity used for the request is no longer valid.
      *
-     * <p>The default implementation is a no-op. Caching resolvers (such as {@link CachingIdentityResolver}) override
-     * this to clear their cache.
+     * <p>The default implementation is a no-op. Refreshable caching resolvers such as
+     * {@link CachingIdentityResolver} can require a refresh while retaining the cached identity as a fallback.
+     *
+     * @param rejectedIdentity identity used to sign the rejected request.
      */
-    default void invalidate() {}
+    default void invalidate(IdentityT rejectedIdentity) {}
 
     /**
      * Combines multiple identity resolvers with the same identity type into a single resolver.

auth-api/src/main/java/software/amazon/smithy/java/auth/api/identity/IdentityResolverChain.java

@@ -39,4 +39,11 @@ public IdentityResult<IdentityT> resolveIdentity(Context requestProperties) {
         }
         return IdentityResult.ofError(IdentityResolverChain.class, "Attempted resolvers: " + errors);
     }
+
+    @Override
+    public void invalidate(IdentityT rejectedIdentity) {
+        for (var resolver : resolvers) {
+            resolver.invalidate(rejectedIdentity);
+        }
+    }
 }

auth-api/src/main/java/software/amazon/smithy/java/auth/api/identity/NonRecoverableIdentityException.java

@@ -0,0 +1,23 @@
+/*
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package software.amazon.smithy.java.auth.api.identity;
+
+/**
+ * Signals that refreshing an identity is not expected to succeed without external action.
+ *
+ * <p>Caching resolvers propagate this exception from on-demand resolutions and do not apply refresh backoff.
+ * Background refreshes retain cached identities and retry on the next on-demand resolution.
+ */
+public class NonRecoverableIdentityException extends RuntimeException {
+
+    public NonRecoverableIdentityException(String message) {
+        super(message);
+    }
+
+    public NonRecoverableIdentityException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}